docs(examples): add GitHub Actions workflow for Bedrock scans

[mldangelo-oai]

Summary

Add a copyable GitHub Actions example for running Codex Security through Amazon Bedrock. It connects existing diff-scan and SARIF-export commands to AWS OIDC, GitHub Code Scanning, and downloadable reports.

Changes

• Add examples/github-actions/codex-security.yml for same-repository PR-diff scans and manual full scans, with an optional weekly schedule.
• Pin the latest stable actions verified on September 11, 2026: checkout 7.0.1, setup-node 7.0.0, setup-python 7.0.0, configure-aws-credentials 6.2.4, CodeQL upload-sarif 4.38.0, and upload-artifact 7.0.1. All actions use exact commit SHAs.
• Use published CLI 0.1.27, Node.js 24.21.0 (active LTS), and Python 3.14.7. Rely on the CLI's existing Bedrock reasoning-summary default.
• Install the CLI before checkout, scope short-lived AWS credentials to the scan step, and disable checkout credential persistence.
• Default to report-only scanning, support an optional severity gate, preserve failures, and upload SARIF only after a completed scan and successful export.
• Document setup, contributor trust, and result handling; link from the examples index. The simplification pass removes duplicated guidance and narrows test assertions to behavior rather than full configuration snapshots.

Testing

• actionlint examples/github-actions/codex-security.yml passed, including ShellCheck.
• bun test --timeout 30000 tests-ts/github-actions-example.test.ts tests-ts/mock-scan.test.ts tests-ts/targets.test.ts tests-ts/cli-export.test.ts tests-ts/sarif.test.ts tests-ts/config.test.ts passed: 98 tests, 4 platform/sandbox-specific skips, no failures. This includes all 9 workflow regression tests.
• pnpm --dir sdk/typescript run build:plugin passed using this PR's verified native bundle.
• SDK build, types, and format passed, along with explicit Prettier checks of all changed files and git diff --check.
• Executed the workflow's scan/export shell blocks with the pinned published CLI on Node.js 24.21.0 and Python 3.14.7, adding only --mock to avoid inference. Full scans exited 0; severity-gated diff scans exited 1. Both exported valid SARIF 2.1.0 with synthetic findings.
• Confirmed the published CLI defaults Bedrock reasoning summaries to none while preserving high reasoning effort.
• Live AWS OIDC, Bedrock inference, and GitHub SARIF ingestion were not exercised; these require a configured destination repository and AWS role.

Risk and rollout

The workflow is an example under examples/, not an active workflow in this repository. Adoption requires copying it into a destination repository and configuring its variables, AWS trust, and GitHub Code Scanning access. It is for trusted same-repository contributors and skips fork, draft, and Dependabot-triggered PRs; the README explains when protected-environment approval is needed.

No public CLI/API or shipped package changes. Reports may contain source snippets and vulnerability details, so adopters must review repository access and retention. The optional schedule remains commented out.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T04:05:48.029528Z	8466281	Manual request
🔒 Security Review	✅ Completed 2026-09-12T04:12:28.377681Z	8466281	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 90c4e56c8d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

Please review the updated head 8466281.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 8466281c13

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".